Ubuntu Security Notice USN-6738-1

==========================================================================
Ubuntu Security Notice USN-6738-1
April 22, 2024

lxd vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

– Ubuntu 18.04 LTS (Available with Ubuntu Pro)
– Ubuntu 16.04 LTS (Available with Ubuntu Pro)

Summary:

LXD could be made to bypass integrity checks if it received specially crafted
input.

Software Description:
– lxd: Container hypervisor based on LXC

Details:

Fabian Bäumer, Marcus Brinkmann, and Jörg Schwenk discovered that LXD
incorrectly handled the handshake phase and the use of sequence numbers in SSH
Binary Packet Protocol (BPP). If a user or an automated system were tricked
into opening a specially crafted input file, a remote attacker could possibly
use this issue to bypass integrity checks.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 18.04 LTS (Available with Ubuntu Pro):
lxd 3.0.3-0ubuntu1~18.04.2+esm1
lxd-client 3.0.3-0ubuntu1~18.04.2+esm1
lxd-tools 3.0.3-0ubuntu1~18.04.2+esm1

Ubuntu 16.04 LTS (Available with Ubuntu Pro):
golang-github-lxc-lxd-dev 2.0.11-0ubuntu1~16.04.4+esm1
lxc2 2.0.11-0ubuntu1~16.04.4+esm1
lxd 2.0.11-0ubuntu1~16.04.4+esm1
lxd-client 2.0.11-0ubuntu1~16.04.4+esm1
lxd-tools 2.0.11-0ubuntu1~16.04.4+esm1

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-6738-1
CVE-2023-48795